1 // SPDX-License-Identifier: GPL-2.0+
3 * Copyright (C) 2007 Alan Stern
4 * Copyright (C) IBM Corporation, 2009
5 * Copyright (C) 2009, Frederic Weisbecker <fweisbec@gmail.com>
7 * Thanks to Ingo Molnar for his many suggestions.
9 * Authors: Alan Stern <stern@rowland.harvard.edu>
10 * K.Prasad <prasad@linux.vnet.ibm.com>
11 * Frederic Weisbecker <fweisbec@gmail.com>
15 * HW_breakpoint: a unified kernel/user-space hardware breakpoint facility,
16 * using the CPU's debug registers.
17 * This file contains the arch-independent routines.
20 #include <linux/hw_breakpoint.h>
22 #include <linux/bug.h>
23 #include <linux/cpu.h>
24 #include <linux/export.h>
25 #include <linux/init.h>
26 #include <linux/irqflags.h>
27 #include <linux/kdebug.h>
28 #include <linux/kernel.h>
29 #include <linux/mutex.h>
30 #include <linux/notifier.h>
31 #include <linux/percpu.h>
32 #include <linux/rhashtable.h>
33 #include <linux/sched.h>
34 #include <linux/slab.h>
40 /* Number of pinned cpu breakpoints in a cpu */
41 unsigned int cpu_pinned;
42 /* tsk_pinned[n] is the number of tasks having n+1 breakpoints */
43 #ifdef hw_breakpoint_slots
44 unsigned int tsk_pinned[hw_breakpoint_slots(0)];
46 unsigned int *tsk_pinned;
48 /* Number of non-pinned cpu/task breakpoints in a cpu */
49 unsigned int flexible; /* XXX: placeholder, see fetch_this_slot() */
52 static DEFINE_PER_CPU(struct bp_cpuinfo, bp_cpuinfo[TYPE_MAX]);
54 static struct bp_cpuinfo *get_bp_info(int cpu, enum bp_type_idx type)
56 return per_cpu_ptr(bp_cpuinfo + type, cpu);
59 /* Keep track of the breakpoints attached to tasks */
60 static struct rhltable task_bps_ht;
61 static const struct rhashtable_params task_bps_ht_params = {
62 .head_offset = offsetof(struct hw_perf_event, bp_list),
63 .key_offset = offsetof(struct hw_perf_event, target),
64 .key_len = sizeof_field(struct hw_perf_event, target),
65 .automatic_shrinking = true,
68 static bool constraints_initialized __ro_after_init;
70 /* Gather the number of total pinned and un-pinned bp in a cpuset */
71 struct bp_busy_slots {
73 unsigned int flexible;
76 /* Serialize accesses to the above constraints */
77 static DEFINE_MUTEX(nr_bp_mutex);
79 #ifdef hw_breakpoint_slots
81 * Number of breakpoint slots is constant, and the same for all types.
83 static_assert(hw_breakpoint_slots(TYPE_INST) == hw_breakpoint_slots(TYPE_DATA));
84 static inline int hw_breakpoint_slots_cached(int type) { return hw_breakpoint_slots(type); }
85 static inline int init_breakpoint_slots(void) { return 0; }
88 * Dynamic number of breakpoint slots.
90 static int __nr_bp_slots[TYPE_MAX] __ro_after_init;
92 static inline int hw_breakpoint_slots_cached(int type)
94 return __nr_bp_slots[type];
97 static __init int init_breakpoint_slots(void)
101 for (i = 0; i < TYPE_MAX; i++)
102 __nr_bp_slots[i] = hw_breakpoint_slots(i);
104 for_each_possible_cpu(cpu) {
105 for (i = 0; i < TYPE_MAX; i++) {
106 struct bp_cpuinfo *info = get_bp_info(cpu, i);
108 info->tsk_pinned = kcalloc(__nr_bp_slots[i], sizeof(int), GFP_KERNEL);
109 if (!info->tsk_pinned)
116 for_each_possible_cpu(err_cpu) {
117 for (i = 0; i < TYPE_MAX; i++)
118 kfree(get_bp_info(err_cpu, i)->tsk_pinned);
127 __weak int hw_breakpoint_weight(struct perf_event *bp)
132 static inline enum bp_type_idx find_slot_idx(u64 bp_type)
134 if (bp_type & HW_BREAKPOINT_RW)
141 * Report the maximum number of pinned breakpoints a task
144 static unsigned int max_task_bp_pinned(int cpu, enum bp_type_idx type)
146 unsigned int *tsk_pinned = get_bp_info(cpu, type)->tsk_pinned;
149 for (i = hw_breakpoint_slots_cached(type) - 1; i >= 0; i--) {
150 if (tsk_pinned[i] > 0)
158 * Count the number of breakpoints of the same type and same task.
159 * The given event must be not on the list.
161 static int task_bp_pinned(int cpu, struct perf_event *bp, enum bp_type_idx type)
163 struct rhlist_head *head, *pos;
164 struct perf_event *iter;
168 head = rhltable_lookup(&task_bps_ht, &bp->hw.target, task_bps_ht_params);
172 rhl_for_each_entry_rcu(iter, pos, head, hw.bp_list) {
173 if (find_slot_idx(iter->attr.bp_type) == type &&
174 (iter->cpu < 0 || cpu == iter->cpu))
175 count += hw_breakpoint_weight(iter);
183 static const struct cpumask *cpumask_of_bp(struct perf_event *bp)
186 return cpumask_of(bp->cpu);
187 return cpu_possible_mask;
191 * Report the number of pinned/un-pinned breakpoints we have in
192 * a given cpu (cpu > -1) or in all of them (cpu = -1).
195 fetch_bp_busy_slots(struct bp_busy_slots *slots, struct perf_event *bp,
196 enum bp_type_idx type)
198 const struct cpumask *cpumask = cpumask_of_bp(bp);
201 for_each_cpu(cpu, cpumask) {
202 struct bp_cpuinfo *info = get_bp_info(cpu, type);
205 nr = info->cpu_pinned;
207 nr += max_task_bp_pinned(cpu, type);
209 nr += task_bp_pinned(cpu, bp, type);
211 if (nr > slots->pinned)
215 if (nr > slots->flexible)
216 slots->flexible = nr;
221 * For now, continue to consider flexible as pinned, until we can
222 * ensure no flexible event can ever be scheduled before a pinned event
226 fetch_this_slot(struct bp_busy_slots *slots, int weight)
228 slots->pinned += weight;
232 * Add a pinned breakpoint for the given task in our constraint table
234 static void toggle_bp_task_slot(struct perf_event *bp, int cpu,
235 enum bp_type_idx type, int weight)
237 unsigned int *tsk_pinned = get_bp_info(cpu, type)->tsk_pinned;
238 int old_idx, new_idx;
240 old_idx = task_bp_pinned(cpu, bp, type) - 1;
241 new_idx = old_idx + weight;
244 tsk_pinned[old_idx]--;
246 tsk_pinned[new_idx]++;
250 * Add/remove the given breakpoint in our constraint table
253 toggle_bp_slot(struct perf_event *bp, bool enable, enum bp_type_idx type,
256 const struct cpumask *cpumask = cpumask_of_bp(bp);
262 /* Pinned counter cpu profiling */
263 if (!bp->hw.target) {
264 get_bp_info(bp->cpu, type)->cpu_pinned += weight;
268 /* Pinned counter task profiling */
269 for_each_cpu(cpu, cpumask)
270 toggle_bp_task_slot(bp, cpu, type, weight);
273 return rhltable_insert(&task_bps_ht, &bp->hw.bp_list, task_bps_ht_params);
275 return rhltable_remove(&task_bps_ht, &bp->hw.bp_list, task_bps_ht_params);
278 __weak int arch_reserve_bp_slot(struct perf_event *bp)
283 __weak void arch_release_bp_slot(struct perf_event *bp)
288 * Function to perform processor-specific cleanup during unregistration
290 __weak void arch_unregister_hw_breakpoint(struct perf_event *bp)
293 * A weak stub function here for those archs that don't define
294 * it inside arch/.../kernel/hw_breakpoint.c
299 * Constraints to check before allowing this new breakpoint counter:
301 * == Non-pinned counter == (Considered as pinned for now)
303 * - If attached to a single cpu, check:
305 * (per_cpu(info->flexible, cpu) || (per_cpu(info->cpu_pinned, cpu)
306 * + max(per_cpu(info->tsk_pinned, cpu)))) < HBP_NUM
308 * -> If there are already non-pinned counters in this cpu, it means
309 * there is already a free slot for them.
310 * Otherwise, we check that the maximum number of per task
311 * breakpoints (for this cpu) plus the number of per cpu breakpoint
312 * (for this cpu) doesn't cover every registers.
314 * - If attached to every cpus, check:
316 * (per_cpu(info->flexible, *) || (max(per_cpu(info->cpu_pinned, *))
317 * + max(per_cpu(info->tsk_pinned, *)))) < HBP_NUM
319 * -> This is roughly the same, except we check the number of per cpu
320 * bp for every cpu and we keep the max one. Same for the per tasks
324 * == Pinned counter ==
326 * - If attached to a single cpu, check:
328 * ((per_cpu(info->flexible, cpu) > 1) + per_cpu(info->cpu_pinned, cpu)
329 * + max(per_cpu(info->tsk_pinned, cpu))) < HBP_NUM
331 * -> Same checks as before. But now the info->flexible, if any, must keep
332 * one register at least (or they will never be fed).
334 * - If attached to every cpus, check:
336 * ((per_cpu(info->flexible, *) > 1) + max(per_cpu(info->cpu_pinned, *))
337 * + max(per_cpu(info->tsk_pinned, *))) < HBP_NUM
339 static int __reserve_bp_slot(struct perf_event *bp, u64 bp_type)
341 struct bp_busy_slots slots = {0};
342 enum bp_type_idx type;
346 /* We couldn't initialize breakpoint constraints on boot */
347 if (!constraints_initialized)
351 if (bp_type == HW_BREAKPOINT_EMPTY ||
352 bp_type == HW_BREAKPOINT_INVALID)
355 type = find_slot_idx(bp_type);
356 weight = hw_breakpoint_weight(bp);
358 fetch_bp_busy_slots(&slots, bp, type);
360 * Simulate the addition of this breakpoint to the constraints
361 * and see the result.
363 fetch_this_slot(&slots, weight);
365 /* Flexible counters need to keep at least one slot */
366 if (slots.pinned + (!!slots.flexible) > hw_breakpoint_slots_cached(type))
369 ret = arch_reserve_bp_slot(bp);
373 return toggle_bp_slot(bp, true, type, weight);
376 int reserve_bp_slot(struct perf_event *bp)
380 mutex_lock(&nr_bp_mutex);
382 ret = __reserve_bp_slot(bp, bp->attr.bp_type);
384 mutex_unlock(&nr_bp_mutex);
389 static void __release_bp_slot(struct perf_event *bp, u64 bp_type)
391 enum bp_type_idx type;
394 arch_release_bp_slot(bp);
396 type = find_slot_idx(bp_type);
397 weight = hw_breakpoint_weight(bp);
398 WARN_ON(toggle_bp_slot(bp, false, type, weight));
401 void release_bp_slot(struct perf_event *bp)
403 mutex_lock(&nr_bp_mutex);
405 arch_unregister_hw_breakpoint(bp);
406 __release_bp_slot(bp, bp->attr.bp_type);
408 mutex_unlock(&nr_bp_mutex);
411 static int __modify_bp_slot(struct perf_event *bp, u64 old_type, u64 new_type)
415 __release_bp_slot(bp, old_type);
417 err = __reserve_bp_slot(bp, new_type);
420 * Reserve the old_type slot back in case
421 * there's no space for the new type.
423 * This must succeed, because we just released
424 * the old_type slot in the __release_bp_slot
425 * call above. If not, something is broken.
427 WARN_ON(__reserve_bp_slot(bp, old_type));
433 static int modify_bp_slot(struct perf_event *bp, u64 old_type, u64 new_type)
437 mutex_lock(&nr_bp_mutex);
438 ret = __modify_bp_slot(bp, old_type, new_type);
439 mutex_unlock(&nr_bp_mutex);
444 * Allow the kernel debugger to reserve breakpoint slots without
445 * taking a lock using the dbg_* variant of for the reserve and
446 * release breakpoint slots.
448 int dbg_reserve_bp_slot(struct perf_event *bp)
450 if (mutex_is_locked(&nr_bp_mutex))
453 return __reserve_bp_slot(bp, bp->attr.bp_type);
456 int dbg_release_bp_slot(struct perf_event *bp)
458 if (mutex_is_locked(&nr_bp_mutex))
461 __release_bp_slot(bp, bp->attr.bp_type);
466 static int hw_breakpoint_parse(struct perf_event *bp,
467 const struct perf_event_attr *attr,
468 struct arch_hw_breakpoint *hw)
472 err = hw_breakpoint_arch_parse(bp, attr, hw);
476 if (arch_check_bp_in_kernelspace(hw)) {
477 if (attr->exclude_kernel)
480 * Don't let unprivileged users set a breakpoint in the trap
481 * path to avoid trap recursion attacks.
483 if (!capable(CAP_SYS_ADMIN))
490 int register_perf_hw_breakpoint(struct perf_event *bp)
492 struct arch_hw_breakpoint hw = { };
495 err = reserve_bp_slot(bp);
499 err = hw_breakpoint_parse(bp, &bp->attr, &hw);
511 * register_user_hw_breakpoint - register a hardware breakpoint for user space
512 * @attr: breakpoint attributes
513 * @triggered: callback to trigger when we hit the breakpoint
514 * @context: context data could be used in the triggered callback
515 * @tsk: pointer to 'task_struct' of the process to which the address belongs
518 register_user_hw_breakpoint(struct perf_event_attr *attr,
519 perf_overflow_handler_t triggered,
521 struct task_struct *tsk)
523 return perf_event_create_kernel_counter(attr, -1, tsk, triggered,
526 EXPORT_SYMBOL_GPL(register_user_hw_breakpoint);
528 static void hw_breakpoint_copy_attr(struct perf_event_attr *to,
529 struct perf_event_attr *from)
531 to->bp_addr = from->bp_addr;
532 to->bp_type = from->bp_type;
533 to->bp_len = from->bp_len;
534 to->disabled = from->disabled;
538 modify_user_hw_breakpoint_check(struct perf_event *bp, struct perf_event_attr *attr,
541 struct arch_hw_breakpoint hw = { };
544 err = hw_breakpoint_parse(bp, attr, &hw);
549 struct perf_event_attr old_attr;
552 hw_breakpoint_copy_attr(&old_attr, attr);
553 if (memcmp(&old_attr, attr, sizeof(*attr)))
557 if (bp->attr.bp_type != attr->bp_type) {
558 err = modify_bp_slot(bp, bp->attr.bp_type, attr->bp_type);
563 hw_breakpoint_copy_attr(&bp->attr, attr);
570 * modify_user_hw_breakpoint - modify a user-space hardware breakpoint
571 * @bp: the breakpoint structure to modify
572 * @attr: new breakpoint attributes
574 int modify_user_hw_breakpoint(struct perf_event *bp, struct perf_event_attr *attr)
579 * modify_user_hw_breakpoint can be invoked with IRQs disabled and hence it
580 * will not be possible to raise IPIs that invoke __perf_event_disable.
581 * So call the function directly after making sure we are targeting the
584 if (irqs_disabled() && bp->ctx && bp->ctx->task == current)
585 perf_event_disable_local(bp);
587 perf_event_disable(bp);
589 err = modify_user_hw_breakpoint_check(bp, attr, false);
591 if (!bp->attr.disabled)
592 perf_event_enable(bp);
596 EXPORT_SYMBOL_GPL(modify_user_hw_breakpoint);
599 * unregister_hw_breakpoint - unregister a user-space hardware breakpoint
600 * @bp: the breakpoint structure to unregister
602 void unregister_hw_breakpoint(struct perf_event *bp)
606 perf_event_release_kernel(bp);
608 EXPORT_SYMBOL_GPL(unregister_hw_breakpoint);
611 * register_wide_hw_breakpoint - register a wide breakpoint in the kernel
612 * @attr: breakpoint attributes
613 * @triggered: callback to trigger when we hit the breakpoint
614 * @context: context data could be used in the triggered callback
616 * @return a set of per_cpu pointers to perf events
618 struct perf_event * __percpu *
619 register_wide_hw_breakpoint(struct perf_event_attr *attr,
620 perf_overflow_handler_t triggered,
623 struct perf_event * __percpu *cpu_events, *bp;
627 cpu_events = alloc_percpu(typeof(*cpu_events));
629 return (void __percpu __force *)ERR_PTR(-ENOMEM);
632 for_each_online_cpu(cpu) {
633 bp = perf_event_create_kernel_counter(attr, cpu, NULL,
640 per_cpu(*cpu_events, cpu) = bp;
647 unregister_wide_hw_breakpoint(cpu_events);
648 return (void __percpu __force *)ERR_PTR(err);
650 EXPORT_SYMBOL_GPL(register_wide_hw_breakpoint);
653 * unregister_wide_hw_breakpoint - unregister a wide breakpoint in the kernel
654 * @cpu_events: the per cpu set of events to unregister
656 void unregister_wide_hw_breakpoint(struct perf_event * __percpu *cpu_events)
660 for_each_possible_cpu(cpu)
661 unregister_hw_breakpoint(per_cpu(*cpu_events, cpu));
663 free_percpu(cpu_events);
665 EXPORT_SYMBOL_GPL(unregister_wide_hw_breakpoint);
668 * hw_breakpoint_is_used - check if breakpoints are currently used
670 * Returns: true if breakpoints are used, false otherwise.
672 bool hw_breakpoint_is_used(void)
676 if (!constraints_initialized)
679 for_each_possible_cpu(cpu) {
680 for (int type = 0; type < TYPE_MAX; ++type) {
681 struct bp_cpuinfo *info = get_bp_info(cpu, type);
683 if (info->cpu_pinned)
686 for (int slot = 0; slot < hw_breakpoint_slots_cached(type); ++slot) {
687 if (info->tsk_pinned[slot])
696 static struct notifier_block hw_breakpoint_exceptions_nb = {
697 .notifier_call = hw_breakpoint_exceptions_notify,
698 /* we need to be notified first */
699 .priority = 0x7fffffff
702 static void bp_perf_event_destroy(struct perf_event *event)
704 release_bp_slot(event);
707 static int hw_breakpoint_event_init(struct perf_event *bp)
711 if (bp->attr.type != PERF_TYPE_BREAKPOINT)
715 * no branch sampling for breakpoint events
717 if (has_branch_stack(bp))
720 err = register_perf_hw_breakpoint(bp);
724 bp->destroy = bp_perf_event_destroy;
729 static int hw_breakpoint_add(struct perf_event *bp, int flags)
731 if (!(flags & PERF_EF_START))
732 bp->hw.state = PERF_HES_STOPPED;
734 if (is_sampling_event(bp)) {
735 bp->hw.last_period = bp->hw.sample_period;
736 perf_swevent_set_period(bp);
739 return arch_install_hw_breakpoint(bp);
742 static void hw_breakpoint_del(struct perf_event *bp, int flags)
744 arch_uninstall_hw_breakpoint(bp);
747 static void hw_breakpoint_start(struct perf_event *bp, int flags)
752 static void hw_breakpoint_stop(struct perf_event *bp, int flags)
754 bp->hw.state = PERF_HES_STOPPED;
757 static struct pmu perf_breakpoint = {
758 .task_ctx_nr = perf_sw_context, /* could eventually get its own */
760 .event_init = hw_breakpoint_event_init,
761 .add = hw_breakpoint_add,
762 .del = hw_breakpoint_del,
763 .start = hw_breakpoint_start,
764 .stop = hw_breakpoint_stop,
765 .read = hw_breakpoint_pmu_read,
768 int __init init_hw_breakpoint(void)
772 ret = rhltable_init(&task_bps_ht, &task_bps_ht_params);
776 ret = init_breakpoint_slots();
780 constraints_initialized = true;
782 perf_pmu_register(&perf_breakpoint, "breakpoint", PERF_TYPE_BREAKPOINT);
784 return register_die_notifier(&hw_breakpoint_exceptions_nb);